Before signing a mac app and uploading it to the app store

Question

I've been dealing with an issue for a while. The issue is that when I submit my mac app to the app store I'm always getting invalid binary and they are saying it's because of an invalid signature. And that I should make sure it's signed with the installer certificate which it is.

Here is the complete message from them:

Dear Developer,

We have discovered one or more issues with your recent binary submission for "Mini Week". The following issues will need to be corrected in order for your application to proceed to review:

Invalid Signature - This error occurs when you have signed your app's installer incorrectly. There are two certs required for this process: the "3rd Party Mac Developer Application" cert and the "3rd Party Mac Developer Installer" cert. When signing your package, you need to ensure that you are using the Installer cert to sign your package. Ensure that you are specifying this cert when submitting your app via the Xcode Organizer or when running productbuild from the command line.

Once you have corrected these issues, go to the app's version details page (found in the Manage Your Applications module of iTunes Connect) and click Ready to Submit Binary. Proceed through the submission process until the app's status is Waiting for Upload. You can then use Application Loader to upload the corrected binary.

Regards,

The iTunes Store Team

I've revoked and reinstalled my certificates and development providing profile but that doesn't seem to help so I'm assuming that's not the issue.

Is there something else that could cause this? Maybe I need to make sure something is correct in my build settings or something like that? But if so what? :)

Thank you in advance!

Answer 1

Actually, the signing process does not happen when you submit the app from Code Organizer. Conversely, it may happen when you build your app for deployment, but only if you selected the appropriate cert on the "Code Signing Identity" in the target build settings.

Note that you could also manually sign an existing app via command line:

codesign -s "<name of your signing cert>" -fv "<path/to/your/app/bundle>" -o kill,hard

where <name of your signing cert> is the canonical name of your 3rd Party Mac Developer Installer cert. The optional -o kill,hard enforces the code signature for the OS to allow user to launch the application: if you omit this option, an user could open the app bundle, delete the code sign folder, and copy the app on a different machine. With this option, your app bundle will only launch on the authorized machine, and will not run when the signature folder is not present.